chore: add monthly flake.lock inputs update workflow

[yvan-sraka]

Adds GitHub Action to automatically update flake.lock every Month. Uses Mic92/update-flake-inputs to create PRs with updated dependencies, preventing large, painful updates like the recent 2-year gap... #1714

Targets develop branch with automated and dependencies labels. Can also be triggered manually via workflow_dispatch.

The workflow is configured with GITHUB_TOKEN which works but won't trigger CI workflows on the created pull requests (GitHub prevents this to avoid infinite loops).

For CI workflows to run on the created PRs, you should set up a GitHub App:

1. Easy setup: Use the web interface to create a GitHub App with correct permissions
2. Configure secrets: Save the App ID as APP_ID and private key as APP_PRIVATE_KEY in repository secrets
3. Update workflow: Replace the github-token step to use the GitHub App token

See the full documentation for detailed instructions.

The current basic setup will work fine for creating PRs, the GitHub App is only needed if you want CI to automatically run on those PRs.

Summary by CodeRabbit

• Chores
  • Added an automated workflow to update the project's lockfile and keep dependencies current.
  • Runs monthly and can be triggered manually; will open automated pull requests with appropriate labels to review and merge updates.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a new GitHub Actions workflow at .github/workflows/update-flake-lock.yml named "Update Flake Lock". It triggers on workflow_dispatch and a monthly cron. The job checks out the repo, installs ephemeral Nix, generates a GitHub App token using secrets, and runs Mic92/update-flake-inputs to update flake.lock (opening PRs with dependency-related labels).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

ci

Suggested reviewers

• hunleyd
• samrose

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: adding a monthly automated workflow for updating flake.lock inputs.
Description check	✅ Passed	The description provides comprehensive context including purpose, implementation details, current limitations, and optional setup instructions for enhanced functionality.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch automate-flake-updates

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[samrose]

close in favor of #2086 as 2086 requires no github app, and catagorizes based on critical, and non-critical, keeps them grouped together instead of distinct PR which is what we'll need to do in practice anyway